CVE-2026-92935

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.4 through 3.11.6

Description A sandbox escape exists when the NodeVM constructor incorrectly validates the require configuration. By providing an array-shaped value to the require parameter while nesting is enabled, the hasRealRequireConfig check is bypassed. This allows the makeResolverFromLegacyOptions() function to return a resolver that grants access to the host vm2 module. An attacker can then instantiate an inner NodeVM with a custom builtin allowlist, such as child process, to execute arbitrary commands with the privileges of the host Node.js process, bypassing outer builtin restrictions.

Recommendations Update to version 3.11.7.